Pipeline main has been shutdown, how to troubleshoot this?

Elastic Stack Logstash
1

Hola Folks,

Thats actually my first week as ELK stack work so I am testing some stuff to end up with a live analysis for all our servers with help of collectd (that's the plan)

Anyways, here is my first logstash conf file and I need to know how usually people troubleshoot this:

$ cat logstash-rubbish.log | ./logstash-2.3.4/bin/logstash -f ./logstash-config-files/test-config.conf -w 1
Settings: User set pipeline workers: 1, Default pipeline workers: 12
Pipeline main started
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}

How to tourbleshoot this, bearing in mind I am using elasticsearch-2.3.5 and it seems to be working

curl -XGET localhost:9200/_template/logstash
{"logstash":{"order":0,"template":"logstash-","settings":{"index":{"refresh_interval":"5s"}},"mappings":{"default":{"dynamic_templates":[{"message_field":{"mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit_norms":true,"type":"string"},"match_mapping_type":"string","match":"message"}},{"string_fields":{"mapping":{"fielddata":{"format":"disabled"},"index":"analyzed","omit_norms":true,"type":"string","fields":{"raw":{"ignore_above":256,"index":"not_analyzed","type":"string"}}},"match_mapping_type":"string","match":""}}],"_all":{"omit_norms":true,"enabled":true},"properties":{"@timestamp":{"type":"date"},"geoip":{"dynamic":true,"properties":{"ip":{"type":"ip"},"latitude":{"type":"float"},"location":{"type":"geo_point"},"longitude":{"type":"float"}}},"@version":{"index":"not_analyzed","type":"string"}}}},"aliases":{}}}[hegz@ansible-machine-2 ~]$

but when running any logstash conf file no luck at all, any suggestions.

BTW, I am just following the docs as well as some Youtube tutorials as a starter?

2

Hi ahegazi,

Does your config file have the output section? If it does not, I believe you need to place the stdout part so it outputs an error when you run it.
Like in HTML, it functions like the footer. It comes after the filter part.

output {
stdout {
codec => rubydebug {
metadata => "true"
}
}
}

3

The fact that Logstash is shutting down isn't surprising if your only input is a stdin input. However, if your output doesn't receive any data then something's wrong.